← Back to Blog

2026-09-22 • 5 min read • Connect

How to Give Cursor Access to Your Private Documentation With MCP

What a private MCP server is, how to create the access token in MCP Studio, and how to send it from Cursor in the Authorization header.

Cursor can read whatever MCP server you point it at. That is useful for a public docs site, and it is the wrong default for the on-call runbook.

A private server refuses every request that does not carry an access token, including the first request Cursor sends when it connects. Without the token, Cursor never sees the server. With it, Cursor can ask the runbook the same way it asks a public docs site.

What the token is

The token is a password for one server. It starts with mcps_live_. You create it on that server's Access panel, and you copy it once. MCP Studio stores a hash, so a lost token is replaced, not displayed again.

The decision of what belongs behind that door is Who can reach your MCP server. This post is the Cursor half of a decision you have already made. The header examples for other clients are in the private servers guide.

Why keep the runbook private

The public site does not know the paging rule. The runbook says payments incidents page the billing channel, not the general on-call channel. A public docs server cannot pass that test. That is the point of a separate server.

One token per laptop is easier to revoke. When someone leaves, you revoke their token. The rest of the team keeps working. You do not rotate a secret that was pasted into a shared doc.

A private GitHub repository belongs here too. Adding one locks the server private until that source is disconnected. A handbook PDF can sit on the same private server. See Build an MCP for your internal knowledge base.

Make the server in MCP Studio

MCP Studio is the no-code builder on Appa Tools. Open the wizard. You do not write any code.

  1. Name it for the audience. On-call runbook is obvious in Cursor's server list. Internal is not.
  2. Add the internal source. A URL your indexer is allowed to read, a private GitHub repository, or an uploaded file. Set the server to private. A private GitHub source does that for you.
  3. Choose search and question answering. Add code example lookup only if the runbook's questions are about the repository.
  4. Deploy, then open Access and create a token. Copy the mcps_live_ value immediately. Do not commit it.

The MCP Studio wizard, showing a source added and ready to deploy

The URL you will put in Cursor looks like this:

https://appatools.com/mcp-studio/api/mcp/your-server-name

Put the token where Cursor will send it

Open Settings → MCP Servers and add the server with a header:

{
  "mcpServers": {
    "internal-docs": {
      "url": "https://appatools.com/mcp-studio/api/mcp/your-server",
      "headers": {
        "Authorization": "Bearer mcps_live_your_token_here"
      }
    }
  }
}

Restart Cursor. It reads this file at startup. A project config can override the global one, so read the MCP settings Cursor says are active for this window.

Before you debug Cursor, prove the token with curl. A tool list means the token is accepted. A 401 means it is missing, revoked, or issued for a different server. Tokens do not transfer between servers.

curl -X POST https://appatools.com/mcp-studio/api/mcp/your-server \
  -H "Authorization: Bearer mcps_live_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

If curl lists tools and Cursor does not, the header is not in the file Cursor loaded, or the window was not restarted. That checklist is Fix an MCP server that isn't showing up in Cursor.

Check that it works

Ask which channel to page for a payments incident. The answer should name the billing channel and cite the runbook. Then ask something the runbook does not contain.

You: What is the office wifi password?

Assistant: Nothing in this server's content covers an office wifi password. The closest material is the payments paging rule, which is a different subject. You would need to add that document as a source.

If the reply is not what you expected

Change one thing. If curl returns 401, create a new token on this server and replace the header. If curl works and Cursor is silent, restart after the edit. Do not put the token in a prompt or a committed file.

Connect Cursor to your private docs today

Connect Cursor to your private docs today. Open MCP Studio, deploy the runbook as a private server, and paste the token into Cursor. Restart, then ask the paging question. The citation is the runbook, or the server is not the one Cursor is calling.

Where to go next